Bug 1521732 - Part 3: Use RootedValueVector instead. r=sfink,jonco

s/AutoValueVector/RootedValueVector/g

Depends on D23183

Differential Revision: https://phabricator.services.mozilla.com/D23184

--HG--
extra : moz-landing-system : lando

devtools/shared/heapsnapshot/HeapSnapshot.cpp

@@ -594,10 +594,10 @@ void HeapSnapshot::ComputeShortestPaths(JSContext* cx, uint64_t start,
 
   for (auto iter = shortestPaths.targetIter(); !iter.done(); iter.next()) {
     JS::RootedValue key(cx, JS::NumberValue(iter.get().identifier()));
-    JS::AutoValueVector paths(cx);
+    JS::RootedValueVector paths(cx);
 
     bool ok = shortestPaths.forEachPath(iter.get(), [&](JS::ubi::Path& path) {
-      JS::AutoValueVector pathValues(cx);
+      JS::RootedValueVector pathValues(cx);
 
       for (JS::ubi::BackEdge* edge : path) {
         JS::RootedObject pathPart(cx, JS_NewPlainObject(cx));

dom/base/ChromeUtils.cpp

@@ -226,7 +226,7 @@ void ChromeUtils::ShallowClone(GlobalObject& aGlobal, JS::HandleObject aObj,
   auto cleanup = MakeScopeExit([&]() { aRv.NoteJSContextException(cx); });
 
   JS::Rooted<JS::IdVector> ids(cx, JS::IdVector(cx));
-  JS::AutoValueVector values(cx);
+  JS::RootedVector<JS::Value> values(cx);
   JS::AutoIdVector valuesIds(cx);
 
   {

dom/base/nsJSEnvironment.cpp

@@ -651,10 +651,10 @@ nsresult nsJSContext::SetProperty(JS::Handle<JSObject*> aTarget,
   }
   JSContext* cx = jsapi.cx();
 
-  JS::AutoValueVector args(cx);
+  JS::RootedVector<JS::Value> args(cx);
 
   JS::Rooted<JSObject*> global(cx, GetWindowProxy());
-  nsresult rv = ConvertSupportsTojsvals(aArgs, global, args);
+  nsresult rv = ConvertSupportsTojsvals(aArgs, global, &args);
   NS_ENSURE_SUCCESS(rv, rv);
 
   // got the arguments, now attach them.
@@ -674,9 +674,9 @@ nsresult nsJSContext::SetProperty(JS::Handle<JSObject*> aTarget,
                                                              : NS_ERROR_FAILURE;
 }
 
-nsresult nsJSContext::ConvertSupportsTojsvals(nsISupports* aArgs,
-                                              JS::Handle<JSObject*> aScope,
-                                              JS::AutoValueVector& aArgsOut) {
+nsresult nsJSContext::ConvertSupportsTojsvals(
+    nsISupports* aArgs, JS::Handle<JSObject*> aScope,
+    JS::MutableHandleVector<JS::Value> aArgsOut) {
   nsresult rv = NS_OK;
 
   // If the array implements nsIJSArgArray, copy the contents and return.

dom/base/nsJSEnvironment.h

@@ -136,7 +136,7 @@ class nsJSContext : public nsIScriptContext {
   // Helper to convert xpcom datatypes to jsvals.
   nsresult ConvertSupportsTojsvals(nsISupports *aArgs,
                                    JS::Handle<JSObject *> aScope,
-                                   JS::AutoValueVector &aArgsOut);
+                                   JS::MutableHandleVector<JS::Value> aArgsOut);
 
   nsresult AddSupportsPrimitiveTojsvals(nsISupports *aArg, JS::Value *aArgv);
 

dom/bindings/BindingUtils.cpp

@@ -3391,7 +3391,7 @@ bool ForEachHandler(JSContext* aCx, unsigned aArgc, JS::Value* aVp) {
       aCx, js::GetFunctionNativeReserved(&args.callee(),
                                          FOREACH_MAPLIKEORSETLIKEOBJ_SLOT));
   MOZ_ASSERT(aArgc == 3);
-  JS::AutoValueVector newArgs(aCx);
+  JS::RootedVector<JS::Value> newArgs(aCx);
   // Arguments are passed in as value, key, object. Keep value and key, replace
   // object with the maplike/setlike object.
   if (!newArgs.append(args.get(0))) {

dom/bindings/Codegen.py

@@ -1234,7 +1234,7 @@ class CGHeaders(CGWrapper):
         # Now for non-callback descriptors make sure we include any
         # headers needed by Func declarations and other things like that.
         for desc in descriptors:
-            # If this is an iterator interface generated for a seperate
+            # If this is an iterator interface generated for a separate
             # iterable interface, skip generating type includes, as we have
             # what we need in IterableIterator.h
             if desc.interface.isExternal() or desc.interface.isIteratorInterface():
@@ -16462,7 +16462,7 @@ class CallbackMember(CGNativeMember):
         if self.argCount > 0:
             argvDecl = fill(
                 """
-                JS::AutoValueVector argv(cx);
+                JS::RootedVector<JS::Value> argv(cx);
                 if (!argv.resize(${argCount})) {
                   aRv.Throw(NS_ERROR_OUT_OF_MEMORY);
                   return${errorReturn};
@@ -17097,7 +17097,7 @@ class CGMaplikeOrSetlikeMethodGenerator(CGThing):
     def appendKeyArgConversion(self):
         """
         Generates the key argument for methods. Helper functions will use
-        an AutoValueVector, while interface methods have seperate JS::Values.
+        a RootedVector<JS::Value>, while interface methods have separate JS::Values.
         """
         if self.helperImpl:
             return ([], ["argv[0]"], [])
@@ -17106,8 +17106,8 @@ class CGMaplikeOrSetlikeMethodGenerator(CGThing):
     def appendKeyAndValueArgConversion(self):
         """
         Generates arguments for methods that require a key and value. Helper
-        functions will use an AutoValueVector, while interface methods have
-        seperate JS::Values.
+        functions will use a RootedVector<JS::Value>, while interface methods have
+        separate JS::Values.
         """
         r = self.appendKeyArgConversion()
         if self.helperImpl:

dom/bindings/ToJSValue.h

@@ -353,7 +353,7 @@ MOZ_MUST_USE bool ToJSValue(JSContext* aCx, T* aArguments, size_t aLength,
   // Make sure we're called in a compartment
   MOZ_ASSERT(JS::CurrentGlobalOrNull(aCx));
 
-  JS::AutoValueVector v(aCx);
+  JS::RootedVector<JS::Value> v(aCx);
   if (!v.resize(aLength)) {
     return false;
   }

dom/plugins/base/nsJSNPRuntime.cpp

@@ -723,7 +723,7 @@ static bool doInvoke(NPObject *npobj, NPIdentifier method,
   }
 
   // Convert args
-  JS::AutoValueVector jsargs(cx);
+  JS::RootedVector<JS::Value> jsargs(cx);
   if (!jsargs.reserve(argCount)) {
     ::JS_ReportOutOfMemory(cx);
     return false;

js/ipc/WrapperAnswer.cpp

@@ -460,8 +460,8 @@ bool WrapperAnswer::RecvCallOrConstruct(const ObjectId& objId,
 
   *result = JSVariant(UndefinedVariant());
 
-  AutoValueVector vals(cx);
-  AutoValueVector outobjects(cx);
+  RootedValueVector vals(cx);
+  RootedValueVector outobjects(cx);
   for (size_t i = 0; i < argv.Length(); i++) {
     if (argv[i].type() == JSParam::Tvoid_t) {
       // This is an outparam.

js/ipc/WrapperOwner.cpp

@@ -580,7 +580,7 @@ bool WrapperOwner::callOrConstruct(JSContext* cx, HandleObject proxy,
   ObjectId objId = idOf(proxy);
 
   InfallibleTArray<JSParam> vals;
-  AutoValueVector outobjects(cx);
+  RootedValueVector outobjects(cx);
 
   RootedValue v(cx);
   for (size_t i = 0; i < args.length() + 2; i++) {

js/public/TypeDecls.h

@@ -105,6 +105,10 @@ typedef PersistentRooted<JS::Symbol*> PersistentRootedSymbol;
 typedef PersistentRooted<JS::BigInt*> PersistentRootedBigInt;
 typedef PersistentRooted<Value> PersistentRootedValue;
 
+template <typename T>
+using HandleVector = Handle<StackGCVector<T>>;
+template <typename T>
+using MutableHandleVector = MutableHandle<StackGCVector<T>>;
 }  // namespace JS
 
 using jsid = JS::PropertyKey;

js/public/Vector.h

@@ -26,7 +26,7 @@ struct TypeIsGCThing<JS::Value> : mozilla::TrueType {};
 
 template <typename T, size_t MinInlineCapacity = 0,
           class AllocPolicy = TempAllocPolicy,
-          // Don't use this with JS::Value!  Use JS::AutoValueVector instead.
+          // Don't use this with JS::Value!  Use JS::RootedValueVector instead.
           typename = typename mozilla::EnableIf<
               !detail::TypeIsGCThing<T>::value>::Type>
 using Vector = mozilla::Vector<T, MinInlineCapacity, AllocPolicy>;

js/src/builtin/Object.cpp

@@ -1261,7 +1261,7 @@ static bool TryEnumerableOwnPropertiesNative(JSContext* cx, HandleObject obj,
 
   *optimized = true;
 
-  AutoValueVector properties(cx);
+  RootedValueVector properties(cx);
   RootedValue key(cx);
   RootedValue value(cx);
 
@@ -1514,7 +1514,7 @@ static bool EnumerableOwnProperties(JSContext* cx, const JS::CallArgs& args) {
   }
 
   // Step 3.
-  AutoValueVector properties(cx);
+  RootedValueVector properties(cx);
   size_t len = ids.length();
   if (!properties.resize(len)) {
     return false;

js/src/builtin/ReflectParse.cpp

@@ -203,7 +203,7 @@ static const char* const callbackNames[] = {
 
 enum YieldKind { Delegating, NotDelegating };
 
-typedef AutoValueVector NodeVector;
+typedef RootedValueVector NodeVector;
 
 /*
  * ParseNode is a somewhat intricate data structure, and its invariants have

js/src/builtin/String.cpp

@@ -3080,7 +3080,7 @@ static ArrayObject* SplitHelper(JSContext* cx, HandleLinearString str,
   }
 
   // Step 3 (reordered).
-  AutoValueVector splits(cx);
+  RootedValueVector splits(cx);
 
   // Step 8 (reordered).
   size_t lastEndIndex = 0;

js/src/builtin/TypedObject.cpp

@@ -776,8 +776,8 @@ JSObject* StructMetaTypeDescr::create(JSContext* cx, HandleObject metaTypeDescr,
   // Iterate through each field. Collect values for the various
   // vectors below and also track total size and alignment. Be wary
   // of overflow!
-  AutoValueVector fieldTypeObjs(cx);  // Type descriptor of each field.
-  bool opaque = false;                // Opacity of struct.
+  RootedValueVector fieldTypeObjs(cx);  // Type descriptor of each field.
+  bool opaque = false;                  // Opacity of struct.
 
   Vector<StructFieldProps> fieldProps(cx);
 
@@ -838,15 +838,15 @@ JSObject* StructMetaTypeDescr::create(JSContext* cx, HandleObject metaTypeDescr,
 /* static */
 StructTypeDescr* StructMetaTypeDescr::createFromArrays(
     JSContext* cx, HandleObject structTypePrototype, bool opaque,
-    bool allowConstruct, AutoIdVector& ids, AutoValueVector& fieldTypeObjs,
+    bool allowConstruct, AutoIdVector& ids, JS::HandleValueVector fieldTypeObjs,
     Vector<StructFieldProps>& fieldProps) {
-  StringBuffer stringBuffer(cx);      // Canonical string repr
-  AutoValueVector fieldNames(cx);     // Name of each field.
-  AutoValueVector fieldOffsets(cx);   // Offset of each field field.
-  AutoValueVector fieldMuts(cx);      // Mutability of each field.
-  RootedObject userFieldOffsets(cx);  // User-exposed {f:offset} object
-  RootedObject userFieldTypes(cx);    // User-exposed {f:descr} object.
-  Layout layout;                      // Field offsetter
+  StringBuffer stringBuffer(cx);       // Canonical string repr
+  RootedValueVector fieldNames(cx);    // Name of each field.
+  RootedValueVector fieldOffsets(cx);  // Offset of each field field.
+  RootedValueVector fieldMuts(cx);     // Mutability of each field.
+  RootedObject userFieldOffsets(cx);   // User-exposed {f:offset} object
+  RootedObject userFieldTypes(cx);     // User-exposed {f:descr} object.
+  Layout layout;                       // Field offsetter
 
   userFieldOffsets = NewBuiltinClassInstance<PlainObject>(cx, TenuredObject);
   if (!userFieldOffsets) {

js/src/builtin/TypedObject.h

@@ -429,7 +429,7 @@ class StructMetaTypeDescr : public NativeObject {
   // The type objects in `fieldTypeObjs` must all be TypeDescr objects.
   static StructTypeDescr* createFromArrays(
       JSContext* cx, HandleObject structTypePrototype, bool opaque,
-      bool allowConstruct, AutoIdVector& ids, AutoValueVector& fieldTypeObjs,
+      bool allowConstruct, AutoIdVector& ids, HandleValueVector fieldTypeObjs,
       Vector<StructFieldProps>& fieldProps);
 
   // Properties and methods to be installed on StructType.prototype,

js/src/ctypes/CTypes.cpp

@@ -6196,7 +6196,7 @@ JSObject* StructType::BuildFieldsArray(JSContext* cx, JSObject* obj) {
   size_t len = fields->count();
 
   // Prepare a new array for the 'fields' property of the StructType.
-  JS::AutoValueVector fieldsVec(cx);
+  JS::RootedValueVector fieldsVec(cx);
   if (!fieldsVec.resize(len)) {
     return nullptr;
   }
@@ -6715,7 +6715,7 @@ bool FunctionType::Create(JSContext* cx, unsigned argc, Value* vp) {
     return ArgumentLengthError(cx, "FunctionType", "two or three", "s");
   }
 
-  AutoValueVector argTypes(cx);
+  JS::RootedValueVector argTypes(cx);
   RootedObject arrayObj(cx, nullptr);
 
   if (args.length() == 3) {
@@ -7078,7 +7078,7 @@ bool FunctionType::ArgTypesGetter(JSContext* cx, const JS::CallArgs& args) {
   // Prepare a new array.
   JS::Rooted<JSObject*> argTypes(cx);
   {
-    JS::AutoValueVector vec(cx);
+    JS::RootedValueVector vec(cx);
     if (!vec.resize(len)) {
       return false;
     }
@@ -7304,7 +7304,7 @@ bool CClosure::ArgClosure::operator()(JSContext* cx) {
   }
 
   // Set up an array for converted arguments.
-  JS::AutoValueVector argv(cx);
+  JS::RootedValueVector argv(cx);
   if (!argv.resize(cif->nargs)) {
     JS_ReportOutOfMemory(cx);
     return false;

js/src/frontend/BytecodeEmitter.cpp

@@ -4379,7 +4379,7 @@ bool ParseNode::getConstantValue(JSContext* cx,
         pn = as<ListNode>().head();
       }
 
-      AutoValueVector values(cx);
+      RootedValueVector values(cx);
       if (!values.appendN(MagicValue(JS_ELEMENTS_HOLE), count)) {
         return false;
       }

js/src/jit/BaselineBailouts.cpp

@@ -903,7 +903,7 @@ static bool InitFromBailout(JSContext* cx, size_t frameNo, HandleFunction fun,
   // side. On the caller side this must represent like the function wasn't
   // inlined.
   uint32_t pushedSlots = 0;
-  AutoValueVector savedCallerArgs(cx);
+  RootedValueVector savedCallerArgs(cx);
   bool needToSaveArgs =
       op == JSOP_FUNAPPLY || IsIonInlinableGetterOrSetterPC(pc);
   if (iter.moreFrames() && (op == JSOP_FUNCALL || needToSaveArgs)) {

js/src/jit/Recover.cpp

@@ -825,7 +825,7 @@ RHypot::RHypot(CompactBufferReader& reader)
     : numOperands_(reader.readUnsigned()) {}
 
 bool RHypot::recover(JSContext* cx, SnapshotIterator& iter) const {
-  JS::AutoValueVector vec(cx);
+  JS::RootedValueVector vec(cx);
 
   if (!vec.reserve(numOperands_)) {
     return false;

js/src/jit/VMFunctions.cpp

@@ -968,7 +968,7 @@ bool NormalSuspend(JSContext* cx, HandleObject obj, BaselineFrame* frame,
   // The expression stack slots are stored on the stack in reverse order, so
   // we copy them to a Vector and pass a pointer to that instead. We use
   // stackDepth - 1 because we don't want to include the return value.
-  AutoValueVector exprStack(cx);
+  RootedValueVector exprStack(cx);
   if (!exprStack.reserve(stackDepth - 1)) {
     return false;
   }

js/src/jsapi-tests/testFunctionBinding.cpp

@@ -27,7 +27,7 @@ BEGIN_TEST(test_functionBinding) {
                                 s1chars, strlen(s1chars), &fun));
   CHECK(fun);
 
-  JS::AutoValueVector args(cx);
+  JS::RootedValueVector args(cx);
   RootedValue rval(cx);
   CHECK(JS::Call(cx, UndefinedHandleValue, fun, args, &rval));
   CHECK(rval.isBoolean());

js/src/jsapi-tests/testMappedArrayBuffer.cpp

@@ -161,7 +161,7 @@ bool TestTransferObject() {
   JS::RootedValue v1(cx, JS::ObjectValue(*obj1));
 
   // Create an Array of transferable values.
-  JS::AutoValueVector argv(cx);
+  JS::RootedValueVector argv(cx);
   if (!argv.append(v1)) {
     return false;
   }

js/src/jsapi-tests/testNewObject.cpp

@@ -53,7 +53,7 @@ static bool constructHook(JSContext* cx, unsigned argc, JS::Value* vp) {
 
 BEGIN_TEST(testNewObject_1) {
   static const size_t N = 1000;
-  JS::AutoValueVector argv(cx);
+  JS::RootedValueVector argv(cx);
   CHECK(argv.resize(N));
 
   JS::RootedValue v(cx);

js/src/shell/js.cpp

@@ -6526,7 +6526,7 @@ static bool DisableSingleStepProfiling(JSContext* cx, unsigned argc,
 
   ShellContext* sc = GetShellContext(cx);
 
-  AutoValueVector elems(cx);
+  RootedValueVector elems(cx);
   for (size_t i = 0; i < sc->stacks.length(); i++) {
     JSString* stack =
         JS_NewUCStringCopyN(cx, sc->stacks[i].begin(), sc->stacks[i].length());

js/src/vm/Debugger.cpp

@@ -2087,7 +2087,7 @@ ResumeMode Debugger::dispatchHook(JSContext* cx, HookIsEnabledFun hookIsEnabled,
   //
   // Note: In the general case, 'triggered' contains references to objects in
   // different compartments--every compartment *except* this one.
-  AutoValueVector triggered(cx);
+  RootedValueVector triggered(cx);
   Handle<GlobalObject*> global = cx->global();
   if (GlobalObject::DebuggerVector* debuggers = global->getDebuggers()) {
     for (auto p = debuggers->begin(); p != debuggers->end(); p++) {
@@ -4047,7 +4047,7 @@ bool Debugger::getDebuggees(JSContext* cx, unsigned argc, Value* vp) {
   // Obtain the list of debuggees before wrapping each debuggee, as a GC could
   // update the debuggees set while we are iterating it.
   unsigned count = dbg->debuggees.count();
-  AutoValueVector debuggees(cx);
+  RootedValueVector debuggees(cx);
   if (!debuggees.resize(count)) {
     return false;
   }
@@ -9295,7 +9295,7 @@ static bool DebuggerGenericEval(JSContext* cx,
   // Gather keys and values of bindings, if any. This must be done in the
   // debugger compartment, since that is where any exceptions must be thrown.
   AutoIdVector keys(cx);
-  AutoValueVector values(cx);
+  RootedValueVector values(cx);
   if (bindings) {
     if (!GetPropertyKeys(cx, bindings, JSITER_OWNONLY, &keys) ||
         !values.growBy(keys.length())) {

js/src/vm/JSObject.cpp

@@ -1698,7 +1698,7 @@ template XDRResult js::XDRObjectLiteral(XDRState<XDR_DECODE>* xdr,
 
 /* static */
 bool NativeObject::fillInAfterSwap(JSContext* cx, HandleNativeObject obj,
-                                   const AutoValueVector& values, void* priv) {
+                                   HandleValueVector values, void* priv) {
   // This object has just been swapped with some other object, and its shape
   // no longer reflects its allocated size. Correct this information and
   // fill the slots in with the specified values.
@@ -1746,9 +1746,8 @@ void JSObject::fixDictionaryShapeAfterSwap() {
   }
 }
 
-static MOZ_MUST_USE bool CopyProxyValuesBeforeSwap(JSContext* cx,
-                                                   ProxyObject* proxy,
-                                                   AutoValueVector& values) {
+static MOZ_MUST_USE bool CopyProxyValuesBeforeSwap(
+    JSContext* cx, ProxyObject* proxy, MutableHandleValueVector values) {
   MOZ_ASSERT(values.empty());
 
   // Remove the GCPtrValues we're about to swap from the store buffer, to
@@ -1774,7 +1773,7 @@ static MOZ_MUST_USE bool CopyProxyValuesBeforeSwap(JSContext* cx,
 }
 
 bool ProxyObject::initExternalValueArrayAfterSwap(
-    JSContext* cx, const AutoValueVector& values) {
+    JSContext* cx, const HandleValueVector values) {
   MOZ_ASSERT(getClass()->isProxy());
 
   size_t nreserved = numReservedSlots();
@@ -1896,7 +1895,7 @@ void JSObject::swap(JSContext* cx, HandleObject a, HandleObject b) {
     NativeObject* nb = b->isNative() ? &b->as<NativeObject>() : nullptr;
 
     // Remember the original values from the objects.
-    AutoValueVector avals(cx);
+    RootedValueVector avals(cx);
     void* apriv = nullptr;
     if (na) {
       apriv = na->hasPrivate() ? na->getPrivate() : nullptr;
@@ -1906,7 +1905,7 @@ void JSObject::swap(JSContext* cx, HandleObject a, HandleObject b) {
         }
       }
     }
-    AutoValueVector bvals(cx);
+    RootedValueVector bvals(cx);
     void* bpriv = nullptr;
     if (nb) {
       bpriv = nb->hasPrivate() ? nb->getPrivate() : nullptr;
@@ -1924,12 +1923,12 @@ void JSObject::swap(JSContext* cx, HandleObject a, HandleObject b) {
         b->is<ProxyObject>() ? &b->as<ProxyObject>() : nullptr;
 
     if (aIsProxyWithInlineValues) {
-      if (!CopyProxyValuesBeforeSwap(cx, proxyA, avals)) {
+      if (!CopyProxyValuesBeforeSwap(cx, proxyA, &avals)) {
         oomUnsafe.crash("CopyProxyValuesBeforeSwap");
       }
     }
     if (bIsProxyWithInlineValues) {
-      if (!CopyProxyValuesBeforeSwap(cx, proxyB, bvals)) {
+      if (!CopyProxyValuesBeforeSwap(cx, proxyB, &bvals)) {
         oomUnsafe.crash("CopyProxyValuesBeforeSwap");
       }
     }

js/src/vm/JSScript.cpp

@@ -4070,7 +4070,7 @@ bool PrivateScriptData::Clone(JSContext* cx, HandleScript src, HandleScript dst,
 
   /* Constants */
 
-  AutoValueVector consts(cx);
+  RootedValueVector consts(cx);
   if (nconsts != 0) {
     RootedValue val(cx);
     RootedValue clone(cx);

js/src/vm/NativeObject.h

@@ -938,7 +938,7 @@ class NativeObject : public ShapedObject {
 
   static MOZ_MUST_USE bool fillInAfterSwap(JSContext* cx,
                                            HandleNativeObject obj,
-                                           const AutoValueVector& values,
+                                           HandleValueVector values,
                                            void* priv);
 
  public:

js/src/vm/ProxyObject.h

@@ -62,8 +62,8 @@ class ProxyObject : public ShapedObject {
         &reinterpret_cast<detail::ProxyValueArray*>(inlineDataStart())
              ->reservedSlots;
   }
-  MOZ_MUST_USE bool initExternalValueArrayAfterSwap(
-      JSContext* cx, const AutoValueVector& values);
+  MOZ_MUST_USE bool initExternalValueArrayAfterSwap(JSContext* cx,
+                                                    HandleValueVector values);
 
   const Value& private_() const { return GetProxyPrivate(this); }
 

js/src/vm/Stack.h

@@ -918,7 +918,7 @@ template <MaybeConstruct Construct>
 class GenericArgsBase : public mozilla::Conditional<Construct, AnyConstructArgs,
                                                     AnyInvokeArgs>::Type {
  protected:
-  AutoValueVector v_;
+  RootedValueVector v_;
 
   explicit GenericArgsBase(JSContext* cx) : v_(cx) {}
 

js/src/vm/StructuredClone.cpp

@@ -64,6 +64,7 @@
 using namespace js;
 
 using JS::CanonicalizeNaN;
+using JS::RootedValueVector;
 using mozilla::BitwiseCast;
 using mozilla::NativeEndian;
 using mozilla::NumbersAreIdentical;
@@ -426,7 +427,7 @@ struct JSStructuredCloneReader {
   JS::StructuredCloneScope allowedScope;
 
   // Stack of objects with properties remaining to be read.
-  AutoValueVector objs;
+  RootedValueVector objs;
 
   // Array of all objects read during this deserialization, for resolving
   // backreferences.
@@ -439,7 +440,7 @@ struct JSStructuredCloneReader {
   //
   // The values in this vector are objects, except it can temporarily have
   // one `undefined` placeholder value (the readTypedArray hack).
-  AutoValueVector allObjs;
+  RootedValueVector allObjs;
 
   // The user defined callbacks that will be used for cloning.
   const JSStructuredCloneCallbacks* callbacks;
@@ -520,7 +521,7 @@ struct JSStructuredCloneWriter {
   //
   // NB: These can span multiple compartments, so the compartment must be
   // entered before any manipulation is performed.
-  AutoValueVector objs;
+  RootedValueVector objs;
 
   // counts[i] is the number of entries of objs[i] remaining to be written.
   // counts.length() == objs.length() and sum(counts) == entries.length().
@@ -532,7 +533,7 @@ struct JSStructuredCloneWriter {
   // For Map: Key followed by value
   // For Set: Key
   // For SavedFrame: parent SavedFrame
-  AutoValueVector otherEntries;
+  RootedValueVector otherEntries;
 
   // The "memory" list described in the HTML5 internal structured cloning
   // algorithm.  memory is a superset of objs; items are never removed from

js/src/vm/TypedArrayObject-inl.h

@@ -452,7 +452,7 @@ class ElementSpecific {
 
     // Convert any remaining elements by first collecting them into a
     // temporary list, and then copying them into the typed array.
-    AutoValueVector values(cx);
+    RootedValueVector values(cx);
     if (!values.append(srcValues + i, len - i)) {
       return false;
     }

js/src/wasm/WasmJS.cpp

@@ -816,7 +816,7 @@ bool WasmModuleObject::imports(JSContext* cx, unsigned argc, Value* vp) {
     return false;
   }
 
-  AutoValueVector elems(cx);
+  RootedValueVector elems(cx);
   if (!elems.reserve(module->imports().length())) {
     return false;
   }
@@ -896,7 +896,7 @@ bool WasmModuleObject::exports(JSContext* cx, unsigned argc, Value* vp) {
     return false;
   }
 
-  AutoValueVector elems(cx);
+  RootedValueVector elems(cx);
   if (!elems.reserve(module->exports().length())) {
     return false;
   }
@@ -985,7 +985,7 @@ bool WasmModuleObject::customSections(JSContext* cx, unsigned argc, Value* vp) {
                                   RangedPtr<char>(name.begin(), name.length()));
   }
 
-  AutoValueVector elems(cx);
+  RootedValueVector elems(cx);
   RootedArrayBufferObject buf(cx);
   for (const CustomSection& cs : module->customSections()) {
     if (name.length() != cs.name.length()) {

js/src/wasm/WasmModule.cpp

@@ -1175,7 +1175,8 @@ static bool CreateExportObject(JSContext* cx,
 #ifdef ENABLE_WASM_GC
 static bool MakeStructField(JSContext* cx, const ValType& v, bool isMutable,
                             const char* format, uint32_t fieldNo,
-                            AutoIdVector* ids, AutoValueVector* fieldTypeObjs,
+                            AutoIdVector* ids,
+                            MutableHandleValueVector fieldTypeObjs,
                             Vector<StructFieldProps>* fieldProps) {
   char buf[20];
   sprintf(buf, format, fieldNo);
@@ -1228,7 +1229,7 @@ static bool MakeStructField(JSContext* cx, const ValType& v, bool isMutable,
     return false;
   }
 
-  if (!fieldTypeObjs->append(ObjectValue(*t))) {
+  if (!fieldTypeObjs.append(ObjectValue(*t))) {
     return false;
   }
 
@@ -1272,7 +1273,7 @@ bool Module::makeStructTypeDescrs(
 
   for (const StructType& structType : structTypes()) {
     AutoIdVector ids(cx);
-    AutoValueVector fieldTypeObjs(cx);
+    RootedValueVector fieldTypeObjs(cx);
     Vector<StructFieldProps> fieldProps(cx);
     bool allowConstruct = true;
 

js/xpconnect/src/XPCWrappedJSClass.cpp

@@ -842,7 +842,7 @@ nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS* wrapper, uint16_t methodIndex,
   RootedValue fval(cx);
   RootedObject thisObj(cx, obj);
 
-  AutoValueVector args(cx);
+  RootedValueVector args(cx);
   AutoScriptEvaluate scriptEval(cx);
 
   XPCJSContext* xpccx = ccx.GetContext();

toolkit/components/telemetry/core/Telemetry.cpp

@@ -1822,7 +1822,7 @@ TelemetryImpl::GetAllStores(JSContext* aCx, JS::MutableHandleValue aResult) {
     return rv;
   }
 
-  JS::AutoValueVector allStores(aCx);
+  JS::RootedVector<JS::Value> allStores(aCx);
   if (!allStores.reserve(stores.Count())) {
     return NS_ERROR_FAILURE;
   }

toolkit/components/telemetry/core/TelemetryEvent.cpp

@@ -586,7 +586,7 @@ nsresult SerializeEventsArray(const EventRecordArray& events, JSContext* cx,
     // [timestamp, category, method, object, value]
     // [timestamp, category, method, object, null, extra]
     // [timestamp, category, method, object, value, extra]
-    JS::AutoValueVector items(cx);
+    JS::RootedVector<JS::Value> items(cx);
 
     // Add timestamp.
     JS::Rooted<JS::Value> val(cx);

toolkit/components/telemetry/core/TelemetryHistogram.cpp

@@ -2260,7 +2260,7 @@ bool internal_JSKeyedHistogram_Keys(JSContext* cx, unsigned argc,
   }
 
   // Convert keys from nsTArray<nsCString> to JS array.
-  JS::AutoValueVector autoKeys(cx);
+  JS::RootedVector<JS::Value> autoKeys(cx);
   if (!autoKeys.reserve(keys.Length())) {
     return false;
   }

widget/android/EventDispatcher.cpp

@@ -397,7 +397,7 @@ nsresult UnboxArrayPrimitive(JSContext* aCx, const jni::Object::LocalRef& aData,
   JNIEnv* const env = aData.Env();
   const ArrayType jarray = ArrayType(aData.Get());
   JNIType* const array = (env->*GetElements)(jarray, nullptr);
-  JS::AutoValueVector elements(aCx);
+  JS::RootedVector<JS::Value> elements(aCx);
 
   if (NS_WARN_IF(!array)) {
     env->ExceptionClear();